The flaw arises from an incorrect processing order that allows a low‑privileged remote attacker, through crafted input, to corrupt the user account state and overwrite existing passwords. This manipulation can precipitate a complete administrative lockout, severing management access to the device and effectively causing a denial‑of‑service for system operators.

The vulnerability impacts ads‑tec Industrial IT devices DVG-IRF1401, DVG-IRF1421, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801 and DVG-IRF3821, which run the IRF1000 and IRF3000 firmware families. No specific firmware version information is provided, so all firmware revisions of the listed models are potentially affected.

The CVSS score of 8.1 indicates high severity. The EPSS score is below 1 %, implying low likelihood of exploitation at this time. The vulnerability is not catalogued in CISA KEV. Though the attacker only needs low‑privileged remote access, the exact attack vector is not explicitly described in the CVE data; based on the description, it is inferred that remote interaction with the device's management interface or a comparable entry point could be used to trigger the account inconsistency, leading to a full administrative lockout.